A remote device may be, for example, a communication device, a blood glucose meter, a smart phone, a personal digital assistant (PDA), a personal computer (PC), or a remote terminal representing a remote infusion pump display on which data from the medical device is displayed to a user. The remote device may also include a bolus advisor by which the user can command the administration of insulin through the infusion pump and on which the delivery history of the infusion pump is displayed. For example, the remote device could be a diabetes management device with the medical device being the infusion pump. Other types of medical devices and remote devices are possible.
A conventional method for pairing and authenticating a medical device with a remote device is where Bluetooth is used for the pairing. For example, authenticating a 10 digit PIN generated by the medical device has to be entered by the user into the remote device. A PIN with more or less digits, for example, an 8 digit PIN, may be used. Then, the medical device and the remote device each generate a signature from the PIN. The remote device sends its signature to the medical device and compares the signature generated by the remote device to the signature generated by the medical device. If the signatures are the same, authentication has been successful. Manually entering a PIN is challenging and difficult for the user. Furthermore, for the PIN to be secure, it usually has to have a large number of digits, i.e. up to 40, which makes entering the PIN even more challenging and difficult for the user. Limited displays and user interfaces can also prove challenging and difficult for a large PIN.
A more secure key exchange can be obtained by public-key cryptography that uses an asymmetric-key method. With an asymmetric-key method the key used to encrypt a message is not the same as the key used to decrypt it. Each user has a pair of cryptographic keys—a public key and a private key. The private key is kept secret, while the public key may be widely distributed. Messages are encrypted with the recipient's public key and can only be decrypted with the corresponding private key. Even though the keys have a mathematical relationship, the private key usually cannot be derived from the public key. Examples for asymmetric-key methods are the Diffie-Hellman key exchange, the RSA method, the Transport Layer Security (TLS), the Rabin technique, the Elgamal cryptosystem, and cryptosystems based on elliptical curves.
While assymetric-key methods have the advantages that sender and recipient do not have to share identical keys to communicate securely and do not require a secure initial exchange of a secret key, compared tosymmetric-key methods, assymetric key methods often rely on complicated mathematical computations and, hence, require more processing power than symmetric-key methods or run slower on systems with comparable processing power. Symmetric-key cryptosystems are generally much less computationally intensive and more efficient than comparable assymetric-key cryptosystems. In practice, asymmetric-key methods are typically s slower than comparable symmetric-key methods, which can be challenging and difficult for existing battery-driven devices, for example, embedded devices (such as an insulin pump), due to their limited processing power, clock rate and memory capacity. With the known asymmetric-key methods, for example, the RSA method, the encryption is significantly faster than the decryption, i.e. more processing power is required for decryption.